diff options
| author | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2021-04-07 20:58:00 +0100 |
|---|---|---|
| committer | Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> | 2021-04-12 22:35:53 +0100 |
| commit | 607206948cacda4a80be5b976dba490970a18a76 (patch) | |
| tree | 632319f6acf459f66a97144a2a41efeb11e7eb77 /hw | |
| parent | 324c8809897c8c53ad05c3a7147d272f1711cd5e (diff) | |
| download | qemu-607206948cacda4a80be5b976dba490970a18a76.zip qemu-607206948cacda4a80be5b976dba490970a18a76.tar.gz qemu-607206948cacda4a80be5b976dba490970a18a76.tar.bz2 | |
esp: ensure that do_cmd is set to zero before submitting an ESP select command
When a CDB has been received and is about to be submitted to the SCSI layer
via one of the ESP select commands, ensure that do_cmd is set to zero before
executing the command.
Otherwise a guest executing 2 valid CDBs in quick sequence can invoke the SCSI
.transfer_data callback again before do_cmd is set to zero by the callback
function triggering an assert at the start of esp_transfer_data().
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20210407195801.685-12-mark.cave-ayland@ilande.co.uk>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/scsi/esp.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 0037197..b668ace 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -357,6 +357,7 @@ static void handle_satn(ESPState *s) cmdlen = get_cmd(s, ESP_CMDFIFO_SZ); if (cmdlen > 0) { s->cmdfifo_cdb_offset = 1; + s->do_cmd = 0; do_cmd(s); } else if (cmdlen == 0) { s->do_cmd = 1; @@ -390,6 +391,7 @@ static void handle_s_without_atn(ESPState *s) cmdlen = get_cmd(s, ESP_CMDFIFO_SZ); if (cmdlen > 0) { s->cmdfifo_cdb_offset = 0; + s->do_cmd = 0; do_busid_cmd(s, 0); } else if (cmdlen == 0) { s->do_cmd = 1; |